Privacy Policy - US Baseline (Texas)

[COMPANY NAME] TEXAS PRIVACY NOTICE

Effective Date: [__/__/____]

Last Updated: [__/__/____]

This Privacy Notice explains how [COMPANY LEGAL NAME] ("Company," "we," "us," or "our") collects, uses, retains, and discloses personal data through [LIST COVERED WEBSITES, APPLICATIONS, PRODUCTS, SERVICES, AND OFFLINE INTERACTIONS] (collectively, the "Services").

1. SCOPE AND CONTACT DETAILS

Company address: [________________________________]

Privacy email: [________________________________]

Request form: [________________________________]

Appeal method: [________________________________]

This Notice applies to: [DESCRIBE COVERED TEXAS CONSUMERS AND INTERACTIONS].

This Notice does not apply to: [IDENTIFY SEPARATELY NOTICED EMPLOYEE, APPLICANT, COMMERCIAL-CONTACT, OR EXEMPT PROCESSING].

The Texas Data Privacy and Security Act generally applies to a person conducting business in Texas or producing products or services consumed by Texas residents that processes or sells personal data and is not a small business as defined by the U.S. Small Business Administration. The statute contains entity- and data-level exemptions. A small business remains subject to the rule against selling sensitive personal data without the consumer's prior consent.

Coverage conclusion and basis: [IN SCOPE / SMALL-BUSINESS LIMITED DUTY / OUT OF SCOPE / VOLUNTARY; EXPLAIN]

2. PERSONAL DATA WE COLLECT

We may create deidentified information. We take reasonable measures to keep it from being associated with an individual, publicly commit to maintain and use it without attempting reidentification, and contractually require recipients to comply with applicable restrictions.

3. HOW WE USE PERSONAL DATA

We use personal data, as applicable, to:

• provide, maintain, personalize, and improve the Services;
• create and administer accounts and transactions;
• communicate about services, support, security, and offers;
• conduct analytics, research, advertising, and campaign measurement;
• authenticate users and detect fraud, abuse, and security incidents;
• comply with law and legal process and protect rights and safety; and
• evaluate or complete a corporate transaction.

We will provide additional notice or obtain consent before processing personal data for a purpose that is not reasonably necessary to or compatible with the disclosed purpose when applicable law requires it.

4. HOW WE DISCLOSE PERSONAL DATA

5. SALE, TARGETED ADVERTISING, PROFILING, AND SENSITIVE DATA

☐ We do not sell personal data.

☐ We sell these categories of personal data: [________________________________].

☐ We do not process personal data for targeted advertising.

☐ We process these categories for targeted advertising: [________________________________].

☐ We do not process personal data for profiling in furtherance of decisions producing legal or similarly significant effects.

☐ We conduct this profiling: [________________________________].

If we sell personal data or process it for targeted advertising, we clearly and conspicuously disclose the activity and the opt-out method.

Privacy choices method: [________________________________]

Authorized-agent or opt-out-signal implementation: [________________________________]

We obtain consent before processing sensitive data where required. For a known child under 13, we process sensitive data in accordance with the Children's Online Privacy Protection Act.

6. SPECIAL TEXAS SALE NOTICES

☐ We do not sell sensitive personal data.

☐ We sell sensitive personal data and display this notice with the privacy notice: NOTICE: We may sell your sensitive personal data.

☐ We do not sell biometric personal data.

☐ We sell biometric personal data and display this notice with the privacy notice: NOTICE: We may sell your biometric personal data.

7. COOKIES AND TRACKING TECHNOLOGIES

Browser Do Not Track response: [________________________________]

Whether other parties collect activity over time and across different websites or services: [________________________________]

8. TEXAS CONSUMER RIGHTS

If the Texas Data Privacy and Security Act applies, and subject to authentication and statutory exceptions, a Texas consumer may request:

• confirmation of processing and access;
• correction of inaccurate personal data;
• deletion of personal data provided by or obtained about the consumer;
• a portable copy of personal data previously provided to the controller; and
• opt-out of targeted advertising, sale, or profiling in furtherance of a decision producing a legal or similarly significant effect.

Submit a Request

• Web form: [________________________________]
• Email: [________________________________]
• Other method: [________________________________]

The Company will maintain at least two secure and reliable request methods unless the exclusively-online exception applies. It will respond without undue delay and no later than 45 days after receipt, subject to one reasonably necessary 45-day extension. Requests are free at least twice annually unless manifestly unfounded, excessive, or repetitive.

Appeals

If we refuse to act, a covered consumer may appeal through [APPEAL METHOD]. We will respond in writing within 60 days after receipt of the appeal and explain the decision. If we deny the appeal, we will provide the Texas Attorney General's online complaint mechanism.

Authorized Agents and Opt-Out Signals

A consumer may designate an authorized agent, including through qualifying browser or device technology, to submit a sale or targeted-advertising opt-out. We will process a qualifying request subject to the identity, authority, residency, technical-capability, and other conditions in Tex. Bus. & Com. Code § 541.055.

9. DATA MINIMIZATION, SECURITY, AND ASSESSMENTS

We limit collection to data that is adequate, relevant, and reasonably necessary for the disclosed purposes. We maintain administrative, technical, and physical safeguards appropriate to the volume and nature of the personal data. No security measure is guaranteed to prevent every incident.

Our processor arrangements address instructions, purpose, data type, duration, confidentiality, consumer-request assistance, return or deletion, assessment cooperation, and subcontractor obligations. As amended effective January 1, 2026, the processor security-assistance duty includes applicable personal data collected, stored, or processed by an artificial intelligence system.

If the Texas law applies, the Company will document data protection assessments for targeted advertising, sale, covered high-risk profiling, sensitive-data processing, and other processing presenting a heightened risk of harm.

Assessment register location: [________________________________]

10. RETENTION AND INTERNATIONAL PROCESSING

We retain each category of personal data only for the period reasonably necessary and proportionate to its disclosed purpose, subject to legal, accounting, security, fraud-prevention, and dispute-resolution needs.

Personal data may be processed in [COUNTRIES OR REGIONS]. Where a transfer mechanism or additional safeguard is legally required, we use [DESCRIBE MECHANISM].

11. CHILDREN'S PRIVACY

☐ The Services are general audience, are not directed to children under 13, and we do not knowingly collect personal information online from a child under 13.

☐ The Services are child-directed or we have actual knowledge of collection from a child under 13. Our children's notice is at [LINK], and we provide notice and obtain verifiable parental consent as required by the Children's Online Privacy Protection Act and 16 C.F.R. Part 312 unless an exception applies.

12. CHANGES AND CONTACT

The "Last Updated" date identifies the latest version. We will provide additional notice and obtain consent before a material change when required.

Questions, requests, or complaints may be sent to:

[COMPANY LEGAL NAME]

Attn: [PRIVACY TEAM OR OFFICER]

[ADDRESS]

[EMAIL]

[PHONE]

SOURCES AND REFERENCES

• 15 U.S.C. § 45
• 15 U.S.C. § 6502
• 16 C.F.R. Part 312
• Texas Business & Commerce Code, Chapter 541
• Texas H.B. 4 enrolled (Texas Data Privacy and Security Act)
• Texas H.B. 149 enrolled (2025 amendment effective January 1, 2026)

Conform this notice to the Company's data inventory, request operations, vendor contracts, advertising technologies, retention schedule, and Texas coverage analysis before publication.